Nautobot

v1.6.10 - 2024-01-22 #5144

glennmatthews started this conversation in General

glennmatthews
Jan 22, 2024
Maintainer

What's Changed

Security

#5109 - Removed /files/get/ URL endpoint (for viewing FileAttachment files in the browser), as it was unused and could potentially pose security issues.
#5134 - Fixed an XSS vulnerability (GHSA-v4xv-795h-rv4h) in the render_markdown() utility function used to render comments, notes, job log entries, etc.

Added

#5134 - Enhanced Markdown-supporting fields (comments, description, Notes, Job log entries, etc.) to also permit the use of a limited subset of "safe" HTML tags and attributes.

Changed

#5132 - Updated poetry version for development Docker image to match 2.0.

Dependencies

#5087 - Updated GitPython to version 3.1.41 to address Windows security vulnerability GHSA-2mqj-m65w-jghx.
#5087 - Updated Jinja2 to version 3.1.3 to address to address XSS security vulnerability GHSA-h5c8-rqwp-cp95.
#5134 - Added nh3 HTML sanitization library as a dependency.

Contributors

Full Changelog: v1.6.9...v1.6.10

This discussion was created from the release v1.6.10 - 2024-01-22.

Replies: 0 comments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment